CVE-2025-43698

—

CVSS 3.1

9.1 critical

EPSS

<1%p40

Published

Jun 10, 2025 (Jun 10, 2025)

Modified

Jun 17, 2026

Description

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025

Weakness: CWE-281
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news3 stories

⚡ Weekly Recap: iPhone Spyware, Microsoft 0-Day, TokenBreak Hack, AI Data Leaks and More

The Hacker NewsOct 28, 08:29 UTC · Oct 28, 2025Malware in the wildCVE-2025-43200 CVE-2025-32711 CVE-2025-33053+24 CVEs2

Researchers Uncover 20+ Configuration Risks, Including Five CVEs, in Salesforce Industry Cloud

The Hacker NewsJun 15, 00:00 UTC · Jun 15, 2025Exploit / PoC CVE-2025-43697 CVE-2025-43698 CVE-2025-43699+3 CVEs

Researcher Finds Five Zero-Days and 20 Misconfigurations in Salesforce

Infosecurity MagazineJun 11, 11:30 UTC · Jun 11, 2025Exploit / PoC CVE-2025-4399 CVE-2025-43700 CVE-2025-43701+2 CVEs